CVE-2017-1000489

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address...

CVE-2017-1000489

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address...

UBUNTU-CVE-2017-17476

Open Ticket Request System OTRS 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attackers to hijack web sessions and consequently gain privileges via a crafted email...

Web Insight Data Not Visible on NetScaler MAS

AppFlow aka Insight has been enabled for the VServer and Services. Enabled Web Insights on NetScaler MAS no data is displayed. Firewall port UDP 4739 is allowed from the NetScaler NSIP/SNIP to the MAS appliance. ULFD was disabled and server was removed...

DEBIAN-CVE-2017-17515

etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to access this...

Description of the security update for Microsoft Exchange: December 12, 2017

None None...

OpenJDK: incorrect enforcement of certificate path restrictions (Security, 8179998)

It was discovered that the Security component of OpenJDK could fail to properly enforce restrictions defined for processing of X.509 certificate chains. A remote attacker could possibly use this flaw to make Java accept certificate using one of the disabled algorithms...

macOS 10.13 Authentication Bypass Remote Check (CVE-2017-13872)

The remote host is affected by an authentication bypass vulnerability. A local attacker or a remote attacker with credentials for a standard user account has the ability to blank out the root account password. This can allow an authenticated attacker to escalate privileges to root and execute...

Google Begins Removing Play Store Apps Misusing Android Accessibility Services

Due to rise in malware and adware abusing Android accessibility services, Google has finally decided to take strict steps against the apps on its app platform that misuse this feature. Google has emailed Android app developers informing them that within 30 days, they must show how accessibility...

pcc - PHP Secure Configuration Checker

Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful tasks. Idea one single file for ea...

FreeFloat FTP Server 1.0 HOST Buffer Overflow

!/usr/bin/python Exploit Title: FreeFloat FTP Server HOST Buffer Overflow ASLR Bypass Date: 11/05/2017 Exploit Author: 1N3@CrowdShield - https://crowdshield Software Link: http://www.freefloat.com/software/freefloatftpserver.zip Version: 1.00 Tested on: Windows Vista SP2 Ultimate x86 ASLR...

Mavenlink: Uninitialized server memory disclosure via ImageMagick gif parser

A CVE in ImageMagick allowed an attacker to recover random server memory via GIF upload. GIF processing has since been disabled...

Disabled Account Bypass

libpam4j is vulnerable to authentication bypass. The authenticate method doesn't check the status of the users account, allowing any attacker with a valid password to login regardless of if the account has been disabled...

GHSA-WW79-8XWV-932X rbovirt uses the rest-client gem with SSL verification disabled

The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors...

HackerOne: Issue with password change in Disabled Account

Hello Hackerone, Summary: I have found that 38343 is not yet fully fixed, disabled user is not always gets notification about password change when a password is changed via password reset link, then such a notification is not send to the disabled user. Description Include Impact: When a password...

libpam4j: Account check bypass

It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

libpam4j: Account check bypass

It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

libpam4j: Account check bypass

It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information...

Security fix for the ALT Linux 9 package apache2 version 1:2.4.28-alt1

Oct. 10, 2017 Anton Farygin 1:2.4.28-alt1 - new version 2.4.28 - disabled NameVirtualHost directive in portsall.conf closes: 32269 - increased timeout for restarting httpd on SysVinit sytems closes: 31062 - increased LOOPSSTART and TimeoutStartSec closes: 33978 - fixes: CVE-2017-9798 Corrupted or...

DEBIAN-CVE-2015-3420

The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service login process crash via vectors related to handshake failures...